MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 546af5248d01e7d2b994944e9dd69ce8de7259515b898f1b8d1f6d811c62b1cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 546af5248d01e7d2b994944e9dd69ce8de7259515b898f1b8d1f6d811c62b1cc
SHA3-384 hash: 2ff55a5e588c0dbe601cf48306567e06f389893ed9eb0b96f323f77fbf96a0d735b0749287f9cefb7c79337f3a662975
SHA1 hash: f7d5c4b258af575c382790859035bccce480ea47
MD5 hash: d2ae1e4522d1f0f9ffcdee7deaabf63e
humanhash: green-six-twelve-louisiana
File name:Hesap Hareketleri.exe
Download: download sample
Signature AZORult
Create hunting rule
File size:858'112 bytes
First seen:2022-04-15 05:31:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:I7j4MgAo7KUy4zkKiMgiZ5VErq4klexsD6KvNvQzsB4XcLQnul+QuDC:MMZ7eyVUklexqNvQcJQnfDC
Threatray 1'533 similar samples on MalwareBazaar
TLSH T1000501416AB2EF32DA3D47FF829031500F7E1E5355A1FA8D6D89B0E62EB5F048540E9B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 31f098b29298f031 (53 x AgentTesla, 30 x Formbook, 12 x RedLineStealer)
Reporter abuse_ch
Tags:AZORult exe geo TUR


Avatar
abuse_ch
AZORult C2:
http://e4v5sa.xyz/PL341/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://e4v5sa.xyz/PL341/index.php https://threatfox.abuse.ch/ioc/519979/

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'601
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
azorult
Create hunting rule
ID:
1
File name:
Hesap Hareketleri.exe
Verdict:
Malicious activity
Analysis date:
2022-04-15 05:32:15 UTC
Tags:
trojan rat azorult stealer
Link:
https://app.any.run/tasks/89f52ad1-064b-4d2d-b603-b32fea9e4046

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Azorult
Create hunting rule
Link:
https://www.capesandbox.com/analysis/263898/
Detection(s):
SecuriteInfo.com.Scr.Malcodegdn30.1126.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Creating a file
Сreating synchronization primitives
DNS request
Sending an HTTP POST request
Creating a file in the %temp% subdirectories
Reading critical registry keys
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/62590353482f2f41cab2fe98/reports/279059ba-a511-4a3e-95ba-9edbf289dd32/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AZORult
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6fad423e-62ac-4884-a7ec-4bb488a6408f
Result
Threat name:
Azorult
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/977264
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected Azorult
Yara detected Azorult Info Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/546af5248d01e7d2b994944e9dd69ce8de7259515b898f1b8d1f6d811c62b1cc/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-15 05:32:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
28
AV detection:
16 of 25 (64.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=krvpkjenaht5fomusrhj3vu45dphewkrloey6g4nd5wychdcwhga._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
023938b0dd03eba6e0b9b40eb2245290a0068dca585a01f72e3a374e064a958a
AZORult
248d88ba77b9221d41aa59d1e05e8aff660a8592b573ddc6d7163cc6cbb59595
AZORult
2dc62cc2665e8ba3e59ce83cbaf60234140a4b472c6fe0f4b20809c4c05c6505
AZORult
49a19077ef760fe9b149db0a5dc267d338d5b41064a2f8f89773e3a94bb7bc1e
AZORult
8a35a3bb04717795ebf8d6c2d3cbcbdfd28edd0597f4e2bd3fc23b4929a86099
AZORult
8a37233d95f2f0c8c3ba7ebab24b0118006d47bded34b0518cd079c1f1e14508
AZORult
ee03a7e0fb12790de85977a9c4bec4d1d0a58e694c292c2b8f67b891770cedc4
AZORult
fe1f268ea15153b6f0e9935ce18b75a2da354ab2f84c3662b29e21054bf2cc22
AZORult
+ 1'523 additional samples on MalwareBazaar
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection discovery infostealer spyware stealer trojan
Link:
https://tria.ge/reports/220415-f8aatsagg7/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads data files stored by FTP clients
Reads local data of messenger clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Azorult
Malware Config
C2 Extraction:
http://e4v5sa.xyz/PL341/index.php
Unpacked files
SH256 hash:
af1f5074eff36653e6d54c5c7aabf990aee2cc70a72db4cfb1707e452349c574
MD5 hash:
fc0ae7f6d4aa4aa2c27c26407936ec3d
SHA1 hash:
dfa9b61be7f02298605ffe7e007617016c9bfc2b
Link:
https://www.unpac.me/results/abe4a72d-ea4d-43c5-a12b-6e833ba29db3/
SH256 hash:
67574f1d2cacec774a38bcb6169f73216c2570e260be9fb18ebeb552685db374
MD5 hash:
fb525246701efa4b9a7544af0013b401
SHA1 hash:
ce6bf915424158735ba83bd9c8f4b24ff2fa5858
Link:
https://www.unpac.me/results/abe4a72d-ea4d-43c5-a12b-6e833ba29db3/
SH256 hash:
e1aed10aab8bbeaec01e0b571706b333bc9136d577fa44c8212944c60a8f36e0
MD5 hash:
2a4fcffed737607d006f604e0d582eef
SHA1 hash:
94f11d4aae43549ea9fdb2c410943f536ab65784
Link:
https://www.unpac.me/results/abe4a72d-ea4d-43c5-a12b-6e833ba29db3/
SH256 hash:
025e6468ba144f2c0280a2f546f5afda1ec9ee80bc44573beee465dc511cb1cd
MD5 hash:
4c43e33242129a9891324a5f10e8884b
SHA1 hash:
8a81f9bcfe7c25089ca454d420949866499c3e85
Detections:
win_azorult_g1
Create hunting rule
win_azorult_auto
Create hunting rule
Link:
https://www.unpac.me/results/abe4a72d-ea4d-43c5-a12b-6e833ba29db3/
Parent samples :
546af5248d01e7d2b994944e9dd69ce8de7259515b898f1b8d1f6d811c62b1cc
60ad58a938752fff5d6e9442d529fe21b5ecca6166ba78f68ec5c810f6285649
fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a
6f3fcb5289438681db409f8a18947f00d89c08029bcf44f1b32b1bca33a3995e
7280219358589f5dbfb3cf116f6ad152671b451f210c563fce287959283e8334
e87856cc1fe76353e5ca3957aa6951f957c6d097407fcc1258ae3d72c8d923b7
5f72024cc8a15038a120024eda6225ea45982eb8d5f37ab49d0b7b0391e9b8b2
c366d2e91be8589969d0a9ada092f3d1ba5586e2394ce811ba6ce06e00866359
2f81e8b71640e7b5770deccc56c23d75240c34a5914dcb138ec2972e624a0f03
36d24df14c30587bab4aec2992cd86d258d0245f01781abb57241005282a8f7e
SH256 hash:
546af5248d01e7d2b994944e9dd69ce8de7259515b898f1b8d1f6d811c62b1cc
MD5 hash:
d2ae1e4522d1f0f9ffcdee7deaabf63e
SHA1 hash:
f7d5c4b258af575c382790859035bccce480ea47
Link:
https://www.unpac.me/results/abe4a72d-ea4d-43c5-a12b-6e833ba29db3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/546af5248d01e7d2b994944e9dd69ce8de7259515b898f1b8d1f6d811c62b1cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/263898/

Comments